0

i have one elf64 not stripped malware, in gdb debug, there are functions like open, connect, fgets, socket etc, which function we should first set breakpoint in order to find malicious ip or website? i set break at connect, but no ip found thanks using string search, there are no malicious ip involved, but open dns ip 8.8.8.8 strace show connect to one directory where so file is located

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.